From 308ef370a99cf591798ec883dca4392ded2cf7b2 Mon Sep 17 00:00:00 2001 From: Manoel Aranda Neto Date: Wed, 1 Jul 2026 11:10:39 +0200 Subject: [PATCH 1/3] fix: make TCP drop recovery test deterministic --- extras/tcp_drop_test.go | 1 + 1 file changed, 1 insertion(+) diff --git a/extras/tcp_drop_test.go b/extras/tcp_drop_test.go index 3b14e946..0e108246 100644 --- a/extras/tcp_drop_test.go +++ b/extras/tcp_drop_test.go @@ -91,6 +91,7 @@ func TestTCPDropRecovery(t *testing.T) { } client.Close() + require.NoError(t, server.Close(), "Failed to close server") success, failure := callback.GetCounts() assert.Equal(t, 1, success, "Expected 1 success") From 90a77e9f62369c4f9eb7304ac36cd7fde3b54491 Mon Sep 17 00:00:00 2001 From: Manoel Aranda Neto Date: Wed, 1 Jul 2026 11:16:42 +0200 Subject: [PATCH 2/3] ci: allow flags board workflow secrets inheritance --- .github/workflows/call-flags-project-board.yml | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/.github/workflows/call-flags-project-board.yml b/.github/workflows/call-flags-project-board.yml index 0e74e28c..244ecb2e 100644 --- a/.github/workflows/call-flags-project-board.yml +++ b/.github/workflows/call-flags-project-board.yml @@ -9,9 +9,13 @@ on: jobs: call-flags-project: - uses: PostHog/.github/.github/workflows/flags-project-board.yml@d8b55d05dc5150f05c24542a6397ff3ecfbfb56d + uses: PostHog/.github/.github/workflows/flags-project-board.yml@69336b569d22687f8982eea6ff7d450a885cda05 with: pr_number: ${{ github.event.pull_request.number }} pr_node_id: ${{ github.event.pull_request.node_id }} is_draft: ${{ github.event.pull_request.draft }} - secrets: inherit \ No newline at end of file + # The central .github reusable workflow does not declare workflow_call.secrets, + # so explicit secret mapping makes GitHub reject this caller at startup. + # It gates fork/Dependabot PRs before using secrets; keep this scoped call + # as an intentional exception to the broad-inheritance Semgrep rule. + secrets: inherit # nosemgrep From e8d097092c62eb7138653581450c44a3e7946722 Mon Sep 17 00:00:00 2001 From: Manoel Aranda Neto Date: Wed, 1 Jul 2026 11:37:29 +0200 Subject: [PATCH 3/3] address pr review feedback --- .github/workflows/call-flags-project-board.yml | 2 ++ extras/tcp_drop_test.go | 3 +-- 2 files changed, 3 insertions(+), 2 deletions(-) diff --git a/.github/workflows/call-flags-project-board.yml b/.github/workflows/call-flags-project-board.yml index 244ecb2e..0ab36546 100644 --- a/.github/workflows/call-flags-project-board.yml +++ b/.github/workflows/call-flags-project-board.yml @@ -7,6 +7,8 @@ on: pull_request: types: [opened, ready_for_review, review_requested, synchronize, converted_to_draft, reopened] +permissions: {} + jobs: call-flags-project: uses: PostHog/.github/.github/workflows/flags-project-board.yml@69336b569d22687f8982eea6ff7d450a885cda05 diff --git a/extras/tcp_drop_test.go b/extras/tcp_drop_test.go index 0e108246..91b67ead 100644 --- a/extras/tcp_drop_test.go +++ b/extras/tcp_drop_test.go @@ -52,7 +52,6 @@ func TestTCPDropRecovery(t *testing.T) { url, err := server.Start() require.NoError(t, err, "Failed to start server") - defer server.Close() t.Logf("TCP server started at %s", url) callback := newTestCallback(t) @@ -149,7 +148,6 @@ func TestTCPDropFailure(t *testing.T) { url, err := server.Start() require.NoError(t, err, "Failed to start server") - defer server.Close() t.Logf("TCP server started at %s", url) callback := newTestCallback(t) @@ -188,6 +186,7 @@ func TestTCPDropFailure(t *testing.T) { } client.Close() + require.NoError(t, server.Close(), "Failed to close server") success, failure := callback.GetCounts() assert.Equal(t, 10, server.ConnCount())